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1.0 INTRODUCTION 

The Space Launch System (SLS) Program management team has developed a risk and 
opportunity management plan that implements NASA, Explorations Systems Development 
(ESD) Division, and MSFC risk management requirements detailed in NPR 8000.4A, Agency 
Risk Management Procedural Requirements, ESD 10003, Exploration Systems Development 
Risk Management Plan, and MWI 7120.6, Program, Project and Institutional Risk Management. 
These documents contain a strong foundation for risk management; therefore, in an effort to 
reduce duplication, the SLS Program Risk and Opportunity Management Plan focus is on the 
unique SLS Program implementation of the processes. Risk management in the SLS Program is 
closely integrated with other management and decision-making processes so that “risk” is not 
considered separately but is an inherent part of the information presented to decision makers. 

1.1 Purpose 

This plan describes how the NASA Risk Informed Decision Making (RIDM) and Continuous 
Risk and Opportunity Management (CRM) processes will be implemented across the SLS 
Program. It describes the SLS Program risk and opportunity management organization and 
designates the roles, responsibilities, and accountability. It also holds authority for risk 
identification, mitigation, and control, and defines how the SLS Program communicates and 
manages risk and opportunity. 

1.2 Scope 

This plan is implemented within the SLS Program, including Program Planning and Control 
(PP&C), Systems Engineering and Integration (SE&I), all Elements (Booster, Liquid Engines, 
Stages, Spacecraft and Payload Integration, Advanced Development, Ground Operations 
Liaison), and the SLS Program Safety and Mission Assurance (S&MA). This plan is applicable 
to risks associated with cost, schedule, performance (in regard to requirements, operations, and 
supportability), and safety. 

SLS contractors follow the risk management guidance provided in their respective contracts. The 
Element Offices will provide the SLS risk management team insight into the contractors’ risk 
management processes and risks. 

1.3 Change Authority/Responsibility 

The NASA Office of Primary Responsibility (OPR) for this document is the SLS Program 
Planning and Control (PP&C) Office, XP03. 

Proposed changes to this document will be submitted by an SLS Program change request (CR) to 
the SLS Program Control Board (PCB) for disposition. All such requests will adhere to the SLS- 
PLAN-008, SLS Program Configuration Management Plan. 
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2.0 DOCUMENTS 

2.1 Applicable Documents 


The following documents are applicable to the extent specified. Unless otherwise stipulated, the 
most recently approved version of a listed document shall be used. In those situations where the 
most recently approved version is not to be used, the pertinent version is specified in this list. 

SLS-PLAN-001 Space Launch System (SLS) Program Plan 

SLS-PLAN-001, SLS Lessons Learned/Knowledge Management Plan 

Appendix E 


ESD 10003 
NPR 8000.4A 
MWI 7120.6F 
SLS-PLAN-008B 
SLS-PLAN-047A 

SLS-PLAN-003 


Exploration Systems Development Risk Management Plan 
Agency Risk Management Procedural Requirements 
Program, Project and Institutional Risk Management 
SLSP Configuration Management Plan 
SLSP Technical Metrics Plan 

SLSP Systems Engineering Management Plan (SEMP) 


(Baseline Pending) 

SLS-PLAN-026 SLSP Security Management Plan (SMP) 

SLS-RQMT-015A SLSP Hazard Analysis Requirements 

2.2 Reference Documents 


The following documents contain supplemental information to guide the user in the application 
of this document. 


NPR 7120.5E 

ESD 10010 

NAS A/SP-2011-3422 

NPR 2810.1A 

IMS C -PLAN -8000.4 

SLS-PLAN-013A 


NASA Program and Project Management Processes and Requirements 

Cross Program Safety and Mission Assurance Plan 

NASA Risk Management Handbook 

Security of Information Technology 

MSFC Mission Support Risk Management Plan 

Space Launch System (SLS) Program Safety and Mission Assurance 
(S&MA) Plan 


SLS-RPT-102 SLSP Trade Studies 

SLS-RPT-089 SLS Program Top Risk List 
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SLS-RPT-088 

SLS SE&I Top Risk List 

SLS-SPEC-032C 

Space Launch System Program (SLSP) System Specification 


NFS 1807.104 NASA FAR Supplement Acquisition Planning, General Procedures 

NFS 1815.201 NASA FAR Supplement Contracting by Negotiation, Exchanges with 

Industry before receipt of proposals 


NFS 1815.203-72 NASA FAR Supplement Contracting by Negotiation, Risk 

Management 


NFS 1846.401 NASA FAR Supplement Quality Assurance, General 

PIC 02-17 Procurement Information Circular, Government Quality Assurance 

Surveillance Plan (QASP) Guidance 


3.0 ORGANIZATION 


The SLS (level 2) risk management process utili z es existing SLS organizational board structures 
rather than having boards or panels specifically for risk management. The following sections 
describe some roles and responsibilities as they apply to the SLS RIDM and CRM processes. 

3.1 SLS Management Model 

SLS is using a management model that utilizes Program Office, Chief Engineers (CEs), 
Discipline Lead Engineers (DLEs), Lead Systems Engineers (LSEs), and Chief Safety and 
Mission Assurance Officers (CSOs), Figure 3-1. All participants have roles in the risk 
management process. The Program/Element managers, CEs and CSOs roles are addressed in the 
Board sections (sections 3.1 to 3.3) and detailed in NPR 8000.4A, Agency Risk Management 
Procedural Requirements and MWI 7120.6F, Program, Project, and Institutional Risk 
Management. LSEs and DLEs participate in the boards, but have additional functions in the risk 
management process. 
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3.2 Roles and Responsibilities 


3.2.1 Program Control Board 



The SLS Program Control Board (PCB) serves as the program managers risk management board 
for RIDM and CRM activities. A full description of this Board is provided in SLS-PLAN-001, 
Space Launch System Program Plan. 

For the RIDM activities, the Program Manager and PCB ensure that key decisions of the 
organizational unit are risk-informed. Examples of key decisions include: Architecture and 
design decisions, make-buy decisions, source selection in major procurements, budget 
reallocation (allocation of reserves). These decisions are documented in PCB minutes and/or 
Change requests or Directives in accordance with SLS-PLAN-008, Space Launch System 
Program Configuration Management Plan. 

For CRM activities, the Program Manager and PCB approve the Top Program risks (risks to be 
listed on the Program Manager’s Top Risk List). They also, monitor Top Program risks’ 
mitigation progress and eventually “Close” or “Accept” these risks. 

3.2.2 Chief Engineer’s Control Board 

The SLS Chief Engineer’s Control Board (CECB) reviews SE&I risks and provides 
recommendations on those that should be considered Top Program risks. In addition, the Chief 
Engineer has the authority to provide mitigation resources to address risks brought to the CECB. 
The Chief Safety and Mission Assurance Officer (CSO), a member of the CECB is an active 
participant in the risk management process whose approval is required on risk safety scores (on 
risks that have a safety impact) before they proceed to the SLS PCB. 

3.2.3 Element Control Boards 

Element managers are responsible for the risk management processes in their areas. The element 
risk managers (RMs) work with their respective manager and team to implement the SLS risk 
management processes. Elements can elect to have risk boards or utilize their Element Control 
Boards (ECB) to work risks (i.e., approve, accept, close, and monitor risks). Element CSOs 
(ECSOs), as members of their respective ECBs, are active participants in the risk management 
process whose approval is required on risk safety scores (on risks that have a safety impact). 
Element prime contractors will also have risk management processes. The NASA Element RM 
has insight into the prime contractors risk management system and will work with their element 
team to communicate contractor’s risks impact to SLS Program goals or risks that impact other 
elements or Programs (e.g., GSDO or MPCV) to the SLS Program. 

3.2.4 Lead Systems Engineer and Element Lead Systems Engineers 

Element Lead Systems Engineers (ELSEs) facilitate the systems engineering functions described 
in the SLS-PLAN-003, SLSP Systems Engineering Management Plan (SEMP). They also 
provide critical support to the risk management function by helping identify integration risks and 
associated risk handling strategies (e.g. mitigation or acceptance criteria). Risk owners work with 
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the ELSEs to review risks for potential integration threats. In addition, Risk Managers (RMs) 
shall keep ELSEs apprised of new and accepted risks, and risk mitigation activities. 

3.2.5 Discipline Lead Engineers and Element Discipline Lead Engineers 


Discipline Lead Engineers (DLEs) and Element Discipline Lead Engineers (EDLEs) provide 
technical expertise and integration across a technical area (e.g., avionics). They also provide 
critical support to the risk management function by helping identify technical risks, and 
associated risk handling strategies (e.g. mitigation or acceptance criteria). Risk owners work with 
the DLEs/EDLEs to review risks for potential integration threats. In addition, RMs shall keep 
DLEs/EDLEs apprised of new and accepted risks, and risk mitigation activities in their discipline 
area. 
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3.2.6 Security 


Figure 3-2. SE&I Organization Structure 


Information and physical security functions have a risk management function described in NPR 
2810.1A, Security of Information Technology, and SLS-PLAN-026, SLSP Security Management 
Plan (SMP). The SLS Risk Management Officer (RMO) supports the SLS security management 
team to perform the required risk management activities. 

3.2.7 Program Planning and Control 


The SLS PP&C Office provides four key functions that are integral to a successful risk 
management process: risk management, resource management, schedule management, and 
security risks. The roles of each function in the risk management process are outlined in the 
following sections. 

3.2.7.1 Risk Management Function 

SLS risk management integration is provided by the SLS PP&C Office. The SLS Program Risk 
Manager (RM) facilitates the SLS risk management processes across the Program. An extensive 
list of RM responsibilities is listed in NPR 8000.4A and MWI 7120.6F, Program, Project and 
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Institutional Risk Management. Exception: The Prime contractor may utilize the SLS Risk Plan 
or their own corporate risk plan where the prime's risk manager responsibilities are address eel. 

3.2.7.2 Resource Management Function as It Applies to Risk Management 

SLS resource managers work with the risk managers to identify and evaluate the cost impact of 
risks, and help identify mitigation costs. Budget shortfalls identified in the planning activities 
such as the Program Planning and Budget Execution (PPBE), may identify risks. The resource 
manager can enter or request the risk manager to enter these risks in the risk database. Resource 
managers should be consulted on cost impact values and funding for risk mitigation activities to 
ensure their validity. 

The SLS Program/Element Resource Manager: 

• Works with the risk owner to ensure when and how the cost impacts should be phased. 

• Coordinates new cost impacts and updates existing cost impacts and mitigation costs with 
the risk owner, the element risk manager, and the other stakeholders, as required, prior to 
each SLS Monthly Program Review. 

• Coordinates Program cost updates or changes with the SLS Risk Manager using the 
designated risk management database. 

ESD requires program management to show the linkage between their Unallocated Future 
Expense (UFE) and the Program risk posture. SLS will assess the risks against the cost and 
schedule baseline using a quantitative risk assessment (QRA) and identify any UFE shortfalls to 
SLS management. Program management is expected to execute within their program UFE. 
Element risk and resource managers will provide support for the QRA’s through identification of 
risks, mitigation steps, budget planning, cost impacts, liens, and risk mitigation funds. The ORA 
is discussed in detail in Section 4.2.5. Program management will inform ESD regarding the 
reserve usage and trends through Monthly Program Status Reviews (MPSRs) / Comprehensive 
Monthly Program Status Reviews (C-MPSRs). C-MPSR’s are held on a quarterly basis where 
program management will present their updated Threats/Liens.. . 

3.2.7.3 Schedule Management Function as It Applies to Risk Management 

SLS schedulers work with the risk managers to identify schedule threat risks, evaluate schedule 
impacts, and capture approved risk mitigation activities in the schedule. Schedule threats 
identified in the planning activities (e.g., schedule baselining activity) may become risks. To 
improve efficiencies, approved risk mitigation plans should be tracked in the schedule. The risk 
owner, RM, and scheduler work together to move mitigation plans into the applicable schedule 
so that the risk owner only has to report mitigation start and completion dates to the scheduler. 
Key risk score changes, risk buy down, or increases in risk are still reported to the RM. 
Schedulers should be consulted on cost impact values and funding for risk mitigation activities. 

3.2.8 Risk Owner 

Risk owners, not necessarily the risk initiator, are individuals assigned to develop a risk package 
that describes the risk and associated risk handling strategies. They present this package to 
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appropriate boards for review and approval and then manage the risk research or mitigation 
activities. The risk manager works with the risk owner to prepare the risk package and enter the 
applicable data into the risk database (this does not preclude risk owners from entering data into 
the risk database). If the risk plan is tracked in the schedule, the risk owner keeps the scheduler 
apprised on the progress. When a risk is to be closed or accepted, the risk owner updates the risk 
package with closure or acceptance rationale and presents it to the applicable boards. 

4.0 SLS RISK AND OPPORTUNITY MANAGEMENT 

The SLS Program uses the NASA risk management approach that includes both Risk Informed 
Decision Making (RIDM) and Continuous Risk Management (CRM) process defined in NPR 
8000.4A, Agency Risk Management Procedural Requirements, ESD’s guidance in ESD 10003, 
Exploration Systems Development Risk Management Plan, and Center’s guidance in MWI 
7120.6, Marshall Work Instruction, Program, Project and Institutional Risk Management. 

4.1 Risk Informed Decision Making 

Risk Informed Decision Making (RIDM) is a fundamentally deliberative process that uses a 
diverse set of performance measures, along with other considerations, to inform decision making. 
The RIDM process acknowledges the role that human judgment plays in decisions, and that 
technical information cannot be the sole basis for decision making. This is not only because of 
inevitable gaps in the technical information, but also because decision making is an inherently 
subjective, values-based enterprise. In the face of complex decision making involving multiple 
competing objectives, the cumulative judgment provided by experienced personnel is an essential 
element for effectively integrating technical and nontechnical factors to produce sound decisions. 

RIDM is invoked for key decisions such as architecture and design decisions, make-buy 
decisions, source selection in major procurements, and budget reallocation (allocation of UFE), 
which typically involve requirements-setting or re-baselining of requirements. Refer to 
NASA/SP-2011-3422, NASA Risk Management Handbook, for more information on RIDM. 

The SLS Program implements the NASA six step RIDM process as described below: 

Step 1 - Understand Stakeholders Expectations and Derive Performance Measures: 

Accomplished and documented in the SLS-PLAN-001, Section 3.2 Goals and 
Objectives and the technical performance measures (TPMs) listed in SLS-PLAN- 
047, SLSP Technical Metrics Plan. 

Step 2 - Compile Feasible Alternatives. Compile a comprehensive list of feasible 

decision alternatives through a discussion of a reasonable range of alternatives. 

The result is a set of alternatives that can potentially achieve objectives and 
warrant the investment of resources required to analyze them further. SLS 
documents a list of trade studies in SLS-RPT-102, SLSP Trade Studies. 

Step 3 - Set the Framework: The Framework is based on SLS-SPEC-032, Space 
Launch System Program (SLSP) System Specification, as well as 
Decision-Making Guidance in the SLS-PLAN-001, SLS Program Plan 
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and the Decision Analysis process summarized in the SLS-PLAN-003, 

SLSP Systems Engineering Management Plan (SEMP). 

Step 4 - Conduct the Risk Analysis and Document the Results. Each engineering 
discipline can document their results in their trade studies or other 
quantified analysis. The SLS risk management team documents the 
approved risks in the milestone risk assessment reports and the risk 
database. 

Step 5 - Develop Risk-Normalized Performance Commitments: A performance 

commitment is a performance measure value set at a specified percentile of the 
performance measure’s probability density function (PDF). Performance measure 
and associated probability measures are described in SLS-PLAN-047, SLSP 
Technical Metrics Plan. Results of these discussions are reported during the SE&I 
Status to the Chief Engineer meetings and the MPSR. Documentation is recorded 
in the charts for these meetings and provided in a quarterly report to ESD. The 
TPMs listed in SLS-PLAN-047 and programmatic metrics listed in the Program 
monthly package ensure the basis for performance requirements baselines and risk 
tolerance measures are captured and tracked. 

Step 6 - Deliberate, Select an Alternative, and Document the Decision Rationale: Each 
trade study lists the associated deliberation methodology (e.g., Kepner-Tregoe). 

The requirement analysis cycles (RACs) and design analysis cycles (DACs) and 
trade studies use cost, schedule, affordability, performance and programmatic 
measures, safety and other figures of merit (FOMs) to assess various 
alternatives. The risk management team supports these analyses and facilitates 
the development of risks that, for selected alternatives, make their way into the 
CRM process. 

4.2 Continuous Risk Management 

A risk is an event, whether known or unknown, that if it occurs may have a negative impact on a 
goal(s). It is measured with a likelihood of occurrence and severity of consequence (categorized 
as cost, schedule, performance, and/or safety). These risks will be assessed and a risk owner will 
be assigned to develop and then manage the approved risk. CRM is a systematic and iterative 
process that efficiently identifies, analyzes, plans, tracks, controls, communicates, and documents 
risks associated with implementation of designs, plans, and processes. This Plan only lists the 
unique SLS implementation steps (the full CRM process is fully described in NPR8000.4A, 
Agency Risk Management Procedural Requirements and MWI7120.6F, Program, Project and 
Institutional Risk Management). 

Risk statement per NASA/SP-2011-3422, NASA Risk Management Handbook, see the Figure 
below. 
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What Makes Up the preferred Risk Statement? 


Must be a Fact or perceived to be Fact 


Negative impact at a future time 



y will occur^ 

> AFFECTING ^) ASSET >THERE BY RESULTING lf^ (^C ^SEQUEN CE^) 


Primary resource that is affected 


Credible negative impact 


Given that [CONDITION], there is a possibility of [DEPARTURE] adversely impacting [ASSET], 
which could lead to [CONSEQUENCE]. 


Figure 4-1. Risk Statement 

4.2.1 Risk Identification 

All SLS Program and Element team members are encouraged to submit concerns and to engage 
their SLS leads to work concerns internally (i.e., apply resources to address the concern). The 
person who identifies a potential risk or concern, referred to as “the initiator,” should discuss the 
concern with his/her DLE, Lead Systems Engineer (LSE), Systems Engineering Lead Systems 
Engineer, Element Chief Engineer (CE), Systems Engineering Chief Engineer, Chief S&MA 
Officer (CSO), Health and Medical Technical Authority (HMTA) Delegate, SLS manager, or 
element equivalent personnel. This initial assessment should address the following: 

• Is the concern a risk? (Could it result in an undesirable situation or circumstance and have 
a realistic likelihood of occurring?) If the concern is a risk, go to Section 4.2.2, Candidate 
Risk to Approved Risk Development. 

• Is the concern already covered in forward work? (Then it is not a risk.) 

• Can the concern be addressed by funds without going through the risk management 
process? (Management may decide to apply those funds and include it in forward work, 
and then it is not a risk, assuming the funded task provides full mitigation.) 

• Is the concern a known risk (duplicative)? (Review the existing risk and if necessary 
update the description and context.) 

• Is the concern an issue? (Not a risk because the likelihood is 100 percent - the threat has 
occurred.) 

• Is the concern a budget lien or unfunded cost impact? (If it is, then it should be 
communicated to and captured by the resource management team.) NOTE: The unfunded 
cost impacts could also be documented and tracked in ARM. 
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4.2.2 Candidate Risk to Approved Risk Development 

Element Candidate Risk Packages are initially reviewed and approved at the Element level. Next 
the RM works with the appropriate ELSE and the Element Manager or EDLE to determine if the 
risk is isolated to one Element, impacts the overall vehicle, affects multiple Elements (potentially 
a cross-element risk, called a linked risk in the Active Risk Manager (ARM) database), or affects 
multiple Programs (potentially a cross-program risk, termed “Exploration Systems Integrated” 
(ESI) risk). Similarly, when a risk is initiated in SE&I, the SLS SE&I RM will work with the 
appropriate LSE (or the Systems Engineering LSE) and DLEs to determine if the candidate is 
isolated to one element, has cross-element impacts, or cross-program impacts. If a risk has the 
potential to impact the vehicle, multiple Elements, or multiple Programs, it is presented to the 
Systems Engineering LSE (proceed to step 2). If the risk is isolated to one Element, it is managed 
according to Element risk management procedures. 

In order to address each raised concern, the following six steps are systematically followed: 

(1) Develop the Candidate Risk Package - After the concern raised by the initiator is 
determined to be a candidate risk, the initiator works with the element Risk Manager 
(RM), SE&I Risk Manager or RMO to develop a Candidate Risk Package that 
includes: 

a. Risk Statement per NASA/SP-2011-3422, NASA Risk Management Handbook, 
see Figure 4-1, Risk Statement. 

b. Description of the risk (Context). 

c. Timeframe (timeframe to initiate the risk handling strategy). 

d. Risk score (LxC), per SLS risk score card (Figure 4-2). 

e. Recommended risk handling strategy (Mitigate/Accept/Research/Watch). 
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Figure 4-2. Risk Score Card 

(2) Review the Candidate Risk Package - For risks that only affect a single element or 
SE&I, the element RM and initiator/risk owner work with the Element team (ELSE, 
ECE, ECSO, Element Manager), or SE&I equivalent personnel, to review and 
maintain the risk in accordance with risk management procedures. The approved 
risks are documented in the ARM. 

(3) Cross-Program (ESI) or Cross-Element Risk Review - For potential cross- 
program/cross- element risks go to the SE&I weekly Team Meeting. Prior to 
presenting the risk at the SE&I meeting, the RM and risk owner work with the 
LSE/ELSE to schedule a review of the risk package. The LSE meeting is used to pre¬ 
screen the risk to ensure it is: (1) correctly stated (Risk Statement), (2) scoring is 
correct (LxC and Timeframe), and (3) handling strategy is integrated across the 
vehicle (and/or Programs). 

At this point the risk owner will incorporate the recommendations and work with the 
RM to get the risk entered into or updated in the ARM risk database. 
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(4) Cross-Program or Cross-Element Risk Approval - The potential cross-program/cross- 
element risks that complete the LSE screening go to the SLS Chief Engineer Control 
Board (CECB) where they are reviewed and approved. This approval signifies 
concurrence with cross-program/cross-element status. 

The CE decisions include: 

a) The correct handling strategy is listed. 

b) To resource the handling strategy (e.g., utilize existing CE funding to mitigate a 
risk) or to go to the SLS Program for resources or risk acceptance. 

Note 1 : The RM and risk owner work with the applicable scheduler to add the 
approved risk mitigation activities to the schedule for risk tracking. 

Note 2: If the mitigation plan requires a baseline change, the risk package follows 
the Configuration Management (CM) Process for Change Process 
Flow outlined in SLS-PLAN-008. 

c) Is the risk to be tracked at the DLE level (risk folders have been setup in ARM 
under the CE risk level folder for each DLE) or the CE level (these risks are listed 
on the CE’s Top Risk List)? 

d) Is the risk a cross-element risk impacting another SLS Element(s)? 

e) Is the risk a cross-program (ESI) risk, or does it impact another program and/ or 
require mitigation help from another program? If yes, the cross-program risk 
process in ESD 10003 is followed. 

f) Is the risk to be escalated to the SLS Program Top Risk List? 

Note: The PCB approves the SLS Program Top Risk List. 

(5) Risk Handling and Tracking - Next, Program and Element boards implement 
the risk handling strategy (e.g., mitigate, accept, research, watch, or close). 

Risk Managers facilitate this process and help track risks in ARM. 

(6) Cross Program Risk Transfer - The SLS Risk Manager presents any risk 
recommended for transfer to SLS from ESD or the Integrated Risk Working Group 
(IRWG) (multi program risk group defined in ESD 10003) to the SLS CECB. If the 
CECB agrees to take ownership of the risk, an owning organization and risk owner is 
assigned. 

4.2.3 Dissenting Opinion Reclama 

When a concern or candidate risk is disapproved (rejected) the initiator can reclama the decision 
by following the Dissenting Opinions process defined in the SLS-PLAN-001, SLS Program Plan, 
Section 3.5.5.3. 

4.2.4 Risk Escalation 

Escalation of a risk facilitates the flow of risk information to upper management. Every risk 
should be considered for escalation to the next higher level management based on one of the 
following: 
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• A decision is needed at the next higher management level. 

• Transfer of risk to another owning organization (from one Element to another Element or 
to a Program level). The receiving party must agree to take ownership of the risk. 

• Request resources from the next level of management. 

• Coordination/Integration is needed with other organizations/stakeholders whether inside 
or outside the Program, or both. 

o Cross-element risks shall be escalated to SLS SE&I. 

o Cross-program risks shall be identified by the risk managers and confirmed 

through cross-program communication. Once confirmed as an ESI risk, they will 
be marked in the database and presented in the MPSR. They will be escalated to 
ESD through the IRWG as needed. 

• Awareness or visibility to the next higher management level. 

Note\ The SLS Risk Manager also communicates the cross-program risks with 
the ESD IRWG. The Working Group looks at the entire risk set and 
facilitates the ESI (cross- program) risk process (detailed in ESD 10003). 

4.2.5 Quantitative Risk Assessment 

Each Element updates their QRA on a monthly basis in preparation for the MPSR. Element 
resource managers work with their risk managers and team to identify each risk description, risk 
number (if previously entered into the database), the likelihood of the cost occurring, and the 
specific cost impacts by fiscal year. Each risk’s cost impact is monitored (on the left side of the 
QRA template) on a monthly basis and tracked with a trend symbol, indicating whether the cost 
is new, or any decreasing or increasing changes in its status since the last month’s QRA. 

The cost impacts in the QRA are grouped by their likelihood percentage: greater than 50%, equal 
to 50%, and less than 50%. The risk total calculation at the top of the QRA adds up all the cost 
impacts (not including their mitigation costs) whereas the risk total with likelihood factored 
calculates the risk total multiplied by the likelihood factor for all risks that have a likelihood 
greater than or equal to 50%. The cumulative reserve over QRA calculates the difference 
between the total reserves and the risk cost totals with the likelihood greater than or equal to 
50%. During the MPSR, Program management is briefed on the cost impacts that occur during 
the current and future years as well as cost impacts that have a current likelihood greater than or 
equal to 50%. 

In addition to documenting cost impacts and mitigation funds in the risk database, a Quantitative 
Risk Assessment (QRA) is completed and briefed during the MPSR by each Element, SE&I and 
PP&C Office. The goal of the QRA is to communicate to (Program) management the current 
cost impacts and their mitigation costs (if provided). Each Element QRA is combined in the 
Program QRA (QRA roll up) which includes all Program cost impacts and their corresponding 
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mitigation costs. For each fiscal year the total cost impact is identified with a likelihood factor. 
Each total can then be compared to the current Program or Element (financial) reserves. Figure 
4-3 shows the QRA template. 
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Total 

FV13-18 
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Risk Totals 
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$ 6.0 

s - 
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S 6.0 



Booster 

11913 

Risk Name B 

100% 

s - 
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0.3 
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Figure 4-3. Quantitative Risk Assessment Template 


Although mitigation costs are also provided in the QRA, they do not get incorporated in the 
calculations (risk total, risk total with likelihood factored, cumulative reserve over QRA). The 
mitigation costs are provided in the QRA so that management can understand and see the cost 
difference between the cost impact versus the mitigation cost for each risk. 

4.2.6 Risk Acceptance 

The SLS risk management acceptance process follows the risk acceptance policy discussed in the 
SLS-PLAN-001, SLS Program Plan, in Section 3.5.5.2 Risk Acceptance. Accepted risks are risks 
where continued efforts to prevent/mitigate the risks are not deemed practical. A guideline is 
given in Figure 4-4 showing a shaded area indicating scores in which a risk may be closed verses 
the un-shaded area where they may be accepted. 

Approval from the owning organization and the highest level of escalation is required to assign a 
risk the status of accepted (e.g., a SLS risk escalated to ESD requires ESD approval). Risks that 
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have not been escalated may be accepted by the manager of the owning organization (e.g., 
Element Manager for Element risks), but the next higher level of the organization will be 
informed (e.g., Element accepted risk listed in the monthly package presented to the SLS 
Program). All accepted risks will be reviewed monthly by the risk managers, whenever a change 
in the risk circumstances occurs, and at major program reviews. Accepted risks can be re-scored 
and re-classified such that mitigation is necessary. 

On decisions related to technical and operational matters involving safety and mission success 
residual risk, formal concurrence by the responsible Technical Authority(ies) (Engineering, 
S&MA, and/or Health and Medical) is required. Acceptance of safety risks is discussed in further 
detail in SLS-RQMT-015, SLSP Hazard Analysis Requirements. For residual safety risks, the 
acceptance authority is defined in ESD 10010, Cross Program Safety and Mission Assurance 
Plan (Figure 4.1.3-1, Hazard Risk Acceptance Strategy). For residual risks to personnel or high- 
value hardware, the cognizant safety organization must agree that the risk is acceptable. 
(Reference: NPR7120.5E. Section 3.3.2 Other Technical Authority Roles.) Consideration of the 
residual risk for any accepted risk is required and the escalation requirement for risk acceptance 
is specified in the previous paragraph. Concurrence for risk acceptance is to be based on the 
technical merits of the case. 

4.2.7 Risk Closure 

A risk may be closed when further reduction activity is not possible or not practical. A 
guideline is given in Figure 4-4 showing a shaded area indicating scores in which a risk may be 
closed (provided there is not any residual safety risk and with the concurrence of the appropriate 
S&MA Technical Authority representative (e.g., Program CSO for Program-level risks, Element 
CSO for Element -level) versus the un-shaded area where they may be accepted. Conditions that 
may lead to risk closure: 

• Mitigation has ameliorated the risk to the specified area based on the guideline in Figure 
4-4 

• Overcome by Events (OBE), a change in a condition such that the risk goes away or is 
realized 

• The risk is realized and is now an issue/problem (the risk should be referred to an issues 
tracking list). 

• Risk has been combined with another risk so that the other risk is used for tracking and 
disposition. 

Note : The closure rationale must reference the new risk and the new 

risk must reference the closed risk. 

In order to close a risk, approval must be given by the manager whose organization owns the risk 
with concurrence from the S&MA Technical Authority representative and the closure rationale 
must be defined and documented in the risk database. Closure requires approval from the owning 
organization (as stated above) and the highest level of escalation the risk has experienced during 
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mitigation. The closure will be reported to the next higher level of current escalation, (e.g., if 
closed at the Element level, then the SLS Program must be informed). 


General Guideline: 

Risks with these Scores may be Closed 
(Versus Accepted). 



Figure 4-4. Risk/Acceptance versus Closure Guideline 
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4.3 Opportunity Management 



Opportunities are activities that have a potential (likelihood) to benefit (consequence) the 
technical, safety, cost, and/or schedule baseline. They are not risk mitigation activities and may 
not even be activities undertaken by the organization that realizes the improvement. SLS team 
members are encouraged to submit opportunities, especially those that improve affordability and 
safety. Opportunities input by SLS follow the same review and approval process as a risk, except 
the score for consequence utilizes a positive versus a negative factor (see SLS Opportunity 
Scorecard, Figure 4-5). Opportunities input by other Programs/Projects will be monitored to 
determine applicability to the SLS Program and made available to Center and Agency chief 
technologists. 


Rating 

LIKELIHOOD DESCRIPTION 

(i) 

Very Low 

Qualitative: Very unlikely to occur, mgt attn not required in all cases. Strong Controls in Place 
Quan titati ve:: P<1/100000 (pri mary i mpact o n Safety) o r 1 %<P<= 20% (p ri mary i mpact o n 
Cost, Schedule, or Performance) 

(2) 

Low 

Qualitative: Not likely to occur, mgt attn not required in most cases. Controls have minor 
limitations/uncertainties. 

Quantitative:: 1/100000<P<1/10000 (primaryimpacton Safety) or20%<P<=40% (primary 
impact on Cost, Schedule, or Performance) 

(3) 

Moderate 

Qualitative: May occur, mgt required in some cases. Controls exist with some uncertainties. 
Quantitative: 1/10000<P<1/1000 (primary impact on Safety) or40%<P<=60% (primary impact 
on Cost, Schedule, or Performance) 

(4) 

High 

Qualitative: Highlylikelyto occur, most cases require mgt attention. Controls have significant 
uncertainties. 

Quantitative: 1/1000 <P< 1/200 (for risks with primary impacton Safety) or 60%<P<=80% 

(p ri marv i mpact o n Cost, Sch edule, o r Performance) 

(5) 

Very High 

Qualitative: Nearly certain to occur, requires immediate management attention. Controls have 
little or no effect. 

Quantitative: 1/200 <P (for risks with primary impact on Safety) or P>80% (primarv impacton 
Cost, Schedule, or Performance) 



SLS Opportunity Card 
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Opportunity 


Timeframe 

To Initiate 
Handling Strategy 

Near 

0 to 3 months 

Mid 

3 to 9 months 

Far 

>9 months 


BENEFIT 

(-1) 

Very Low 

(-2) 

Low 

(-3) 

Moderate 

(-4) 

High 

(-5) 

Very High 

SAFETY 

Personnel 

avoid negligible injury 
requiringfirstaidtreatment 

avoid minorinjury, illnessor 
incapacitation 

avoid moderate injury, illnessor 
incapacitation 

avoid permanentdisabling 
injury 

avoid death 

Facilities, 

equipment, 

assets 

(avoidance) 

negligible damageto non- 
critical ground facilities or 
systems 

minordamageto non-critical 
ground facilities or systems 

moderate damage to flightassets 
or critical ground facilities or 
systems, or loss of non-critical 
ground facilities or systems 

majordamage to flight 
assets or critical ground 
facilities or systems 

loss of flightassets (vehicle) 
or critical ground facilities or 
systems 

Environmental 

(avoidance) 

negligible OSHA/EPA 
violation 
non-reportable 

minor reportable OSHA/EPA 
violation 

moderate OSHA/EPA violation 
which requires immediate 
remediation 

m ajor OSHA/EPA violation 
causing temporary 
stoppage 

serious or repeat 
OSHA/EPA violations which 
may resultin termination of 
program 

PERFORMANCE 

Requirements 

negligible improvementin 
requirements/design 
margins 

minor improvement in 
requirements/design 
margins 

moderate improvementin 
requirements/design 
margins 

major improvement in 
requirements/design 
margins 

exceptional improvement 
in requirements/design 
margins 

Operations 

negligible improvementin 
mission objectives/ 
operations 

minor improvement 
in operations 

moderate improvementin 
operations. 

major improvement in 
operations 

exceptional improvement 
in operations 

Supportability 

negligible improvementin 
supportability 

minor improvement in 
supportability 

moderate improvementin 
supportability 

major improvement in 
supportability 

exceptional improvement 
in supportability 

Cost (saving) 

<$100K 

>$100Kbut<$1M 

>$1Mbut<$10M 

>$10Mbut£$100M 

>$100M 

Schedule 

<1 month improvement 
in major program milestone 
review 

1-3 month improvement 
in major program milestone 
review 

3-6 month improvementin major 
program milestone review 

6-9 month improvement 
in major program 
milestone review 

>9 month improvement 
in majorprogram milestone 
review 


Figure 4-5. Opportunity Score Card 


Approved for Public Release; Distribution is Unlimited 

The electronic version is the official approved document. 

Verify this is the correct version before use. 

































































Space Launch System (SLS) Program 


Revision: Baseline 

Document No: SLS-PLAN-180 

Effective Date: 3/14/13 

Page: 22 of 26 

Title: SLSP Risk and Opportunity Management Plan 


5.0 RISK BASED ACQUISITION MANAGEMENT 



Acquisition Plans will establish a continuous Risk-Based Acquisition Management (RBAM) 
process to integrate risk management into the acquisition process and ensure the following: 

• NASA FAR Supplement (NFS) 1807.104, NFS 1815.201, NFS 1815.203- 72, 
NFS1846.401, and Procurement Information Circular 02-17 are implemented. 

• During the solicitation process, any exchanges with industry prior to receipt of offers 
should include requests for any perceived risk issues associated with performance of the 
work. 

6.0 SLS RISK MANAGEMENT TRAINING 

All SLS team members that participate in the SLS Risk Management process are required to 
complete SLS Risk Management training. MSFC S&MA works with the SLS RM to develop and 
provide this training. Training records are maintained in the System for Administration, 

Training, and Educational Resources (SATERN) system. 

7.0 RISK MANAGEMENT RECORDS 

The risk management process produces various risk information. This includes: 

• Risk and Opportunity information is documented in SLS Risk Packages and the SLS risk 
database (ARM), or similar contractor risk databases. 

• Risk assessment reports and periodic risk and opportunity status reports generated by the 
RMs are documented in accordance with SLS-PLAN-008. 

• Board risk management documentation is handled in accordance with SLS-PLAN-008 
and is referenced in the unique risk records (in the risk database). 

• The SLS-RPT-089, SLS Program Top Risk List, is controlled and formally updated by 
the SLS PCB. 

• Similarly, the SLS-RPT-088, SLS SE&I Top Risk List, is controlled and formally 
updated by the SLS CECB. 

• Each Element will decide the level of control for their Element Risk Lists. 
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APPENDIX A 



ACRONYMS AND ABBREVIATIONS 
AND GLOSSARY OF TERMS 


A1.0 ACRONYMS AND ABBREVIATIONS 


ARM 

C-MPSR 

CE 

CE 

CECB 

CM 

CR 

CSO 

CRM 

DAC 

DLE 

EDLE 

ESD 

ESI 

FOM 

GSDO 

HMTA 

IRWG 

LSE 

MPCV 

MPSR 

MWI 

OBE 

OPR 

PCB 

PDF 

PPBE 

PP&C 

QRA 

RAC 

RBAM 

RIDM 

RM 

RMO 


Active Risk Manager 

Comprehensive Monthly Program Status Review 

Chief Engineer 

Change Evaluation 

Chief Engineer Control Board 

Configuration Management 

Change Request 

Chief Safety Officer 

Continuous Risk and Opportunity Management 

Design Analysis Cycle 

Discipline Lead Engineer 

Element Discipline Lead Engineer 

Explorations Systems Development 

Exploration Systems Integrated 

Figures of Merit 

Ground Systems Development and Operations 

Health and Medical Technical Authority 

Integrated Risk Working Group 

Lead Systems Engineer 

Multi-Purpose Crew Vehicle 

Monthly Program Status Review 

Marshall Work Instruction 

Overcome By Events 

Office of Primary Responsibility 

Program Control Board 

Probability Density Function 

Program Planning and Budget Execution 

Program Planning and Control 

Quantitative Risk Assessment 

Requirements Analysis Cycle 

Risk Based Acquisition Management 

Risk Informed Decision Making 

Risk Manager 

SLS Risk Management Officer 
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SATERN 

System for Administration, Training, and Educational Resources 

SE&I 

Systems Engineering and Integration 

SEMP 

Systems Engineering Management Plan 

SLS 

Space Launch System 

S&MA 

Safety and Mission Assurance 

TPM 

Technical Performance Measures 

UFE 

Unallocated Future Expense 


A2.0 GLOSSARY OF TERMS 


Term 

Flight 

Cost Impact 
Lien 


Description 

The sequence of events that takes place between liftoff and landing 
of a transportation vehicle. 

Financial impact if a risk is realized. This is the cost consequence 
field on the Risk Scorecard. 

Money owed, like a bill that will need to be paid. 


Mitigation Cost 


Cost associated with mitigating a risk. 
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APPENDIX B 
OPEN WORK 

All resolved TBDs, TBRs, and forward work items should be listed on the Change Request (CR) 
the next time the document is updated and submitted for formal review, and that will serve as the 
formal change record through the configuration management system. 

B1 .0 TO BE DETERMINED (HEADING-APPX STYLE - 11 PT. ALL CAPS AND BOLD) 

Table Bl-1 lists the specific To Be Determined (TBD) items in the document that are not yet 
known. The TBD is inserted as a placeholder wherever the required data is needed and is 
formatted in bold type within carets. The TBD item is sequentially numbered as applicable (i.e., 
<TBD-001> is the first undetermined item assigned in the document). As each TBD is resolved, 
the updated text is inserted in each place that the TBD appears in the document and the item is 
removed from this table. As new TBD items are assigned, they will be added to this list in 
accordance with the above described numbering scheme. Original TBDs will not be renumbered. 

Note: When documenting open work, the book manager shall identify those items whose 
completion is dependent upon the delivery of data from organizations other than the Program 
office, including SLS Elements. This dependency shall be clearly identified in the description 
portion of that open task. This information is important for closure tracking purposes, and for 
capturing Integrated Master Schedule dependencies. (Delete this note for draft or baselined 
documents.) 

Note: Only TBDs and TBRs are used to designate Open Work items. (Delete this note for draft or 
baselined documents.) 

Table Bl-1. To Be Determined Items 


TBD 

Section 

Description 

TBD-001 




B2.0 TO BE RESOLVED 

Table B2-1 lists the specific To Be Resolved (TBR) issues in the document that are not yet 
known. The TBR is inserted as a placeholder wherever the required data is needed and is 
formatted in bold type within carets. The TBR issue is sequentially numbered as applicable (i.e., 
<TBR-001> is the first unresolved issue assigned in the document). As each TBR is resolved, 
the updated text is inserted in each place that the TBR appears in the document and the issue is 
removed from this table. As new TBR issues are assigned, they will be added to this list in 
accordance with the above described numbering scheme. Original TBRs will not be renumbered. 

Table B2-1. To Be Resolved Issues 


TBR 

Section 

Description 

TBR-001 
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B3.0 FORWARD WORK 



Table B3-1 lists the specific forward work items identified during this document’s Change 
Request (CR) review and evaluation. Each item is given a sequential number using a similar 
format to that for the TBDs and TBRs. For each item, include the section number(s) of this 
document that the open work will impact, and in the Description include the specific number of 
the comment from the Change Evaluation (CE), i.e., CE-10, CE-27. Do not include a placeholder 
for forward work items in the body of the document; list them only in Table B3-1. 

Note : If there are no forward work items, do not include this subsection in your document. 

Table B3-1. Forward Work 


FWD 

Section 

Description 

FWD-001 

4.2.4 

Risk De-Escalation 

FWD-002 

4.2.2 

Cross Element Handling Strategies and communication 

FWD-003 

4.3 

Develop Opportunity section, update Scorecard 
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